ZDI-26-637: Oracle Outside In Technology GEM File Parsing Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-60413.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to do to exploit this issue?
The attacker must induce the target to visit a malicious page or open a malicious file. Successful exploitation can result in arbitrary code execution on an affected installation.
Is this vulnerability remotely exploitable without user involvement?
No. Although exploitation is remote, user interaction is required for the target to visit the malicious page or open the malicious file.
Which identifier should be used to track this vulnerability?
This issue is assigned CVE-2026-60413 and is also tracked as ZDI-26-637. The ZDI advisory assigns it a CVSS score of 7.8.